Privacy Policy

Hometown Films Ltd, a company registered in England and Wales under company number 14924230, registered office at 73 Cornhill, London EC3V 3QQ (“ScriptOracle”, “we”, “us”, “our”), is the data controller for the personal data described in this policy.

Contact for privacy queries: contact@thescriptoracle.com.

• Account data: username, email address, and a securely hashed password when you register.
• Payment data: we do not store your card details. Payments are handled by Stripe, our payment processor; we hold a Stripe customer reference and subscription status, not your card number.
• Content you upload: scripts and related material you submit for an Assessment. This may incidentally contain personal data (e.g. names of people mentioned in a script) depending on what you choose to upload.
• Usage data: basic records of activity needed to operate the Service (e.g. which scripts you've submitted, credits used, timestamps).

We do not use analytics, advertising, or tracking cookies. The only cookie the Service sets is a strictly necessary session cookie used to keep you logged in, which does not require consent under the cookie rules (PECR) but is disclosed here for transparency.

• to create and administer your account;
• to provide the Service, including generating Assessments from uploaded scripts;
• to process payments and manage subscriptions via Stripe;
• to communicate with you about your account or the Service (e.g. support requests, credit top-ups);
• to maintain the security and integrity of the Service.

We do not sell your data, and we do not use it for advertising or marketing profiling.

Because scripts can contain commercially sensitive material, we apply additional safeguards beyond standard account security:

• Before an Assessment is generated, script content is passed through an automated redaction process that attempts to mask brand names, agency names, production company names, and personal names before anything is sent to our AI provider. This is a safeguard, not a guarantee.
• Script content sent to our AI provider (Anthropic) is processed under our commercial agreement with them, under which it is treated as confidential, is not used to train their models, and is not retained by them beyond what's needed to process the request.
• Script content is encrypted at rest on our servers and is automatically and permanently deleted no later than 24 hours after upload. You can also delete a script and its result manually at any time before it expires.
• Our production database requires authenticated access — there is no public version of this data.

We share personal data with the following third parties, only as needed to operate the Service:

Each of these providers processes data under their own terms and, where applicable, as our data processor. We do not otherwise share personal data with third parties, and we never sell it.

Some of the providers listed above (including Anthropic and Stripe) may process data outside the UK/EEA, including in the United States. Where this happens, we rely on appropriate safeguards recognised under UK data protection law, such as Standard Contractual Clauses, to ensure your data remains protected.

• Script content: automatically deleted within 24 hours of upload, or sooner if you delete it manually (see Section 4).
• Account data: kept for as long as your account is active, and for a reasonable period afterwards to meet legal, accounting, or dispute-resolution obligations.
• Payment records: retained as required by UK tax and accounting law (typically 6 years).

Under UK GDPR, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of your data (subject to our legal retention obligations, e.g. for payment records);
• request a copy of your data in a portable format;
• object to or restrict certain processing;
• complain to the UK Information Commissioner's Office (ICO) if you believe we have mishandled your data.

To exercise any of these rights, contact us at contact@thescriptoracle.com.

We use encryption, access controls, and authentication to protect your data, as described in Section 4. No system is perfectly secure, and we cannot guarantee absolute security, but we take reasonable and appropriate measures to protect the data we hold.

The Service is intended for business use by production professionals and is not directed at, or intended for use by, children.

We may update this policy from time to time. Material changes will be notified to active users by email or via the Service. The date of the last update is shown at the top of this page.

Questions about this policy, or to exercise your data rights, can be sent to contact@thescriptoracle.com.